Notes on building ventures, compliance, engineering, Artificial Intelligence, Automations, mobilizing talent across borders, and many more — written by the people doing the work.
Latest
A practical guide to the NIST AI Risk Management Framework (AI RMF 1.0) — the four core functions, how to apply them to AI system development and deployment, and how AI RMF aligns with the EU AI Act and emerging AI governance requirements.
Read the Story
A comprehensive guide to ISO 31000, the international standard for risk management principles and guidelines. Learn how to implement a risk management framework that integrates with ISO 27001, COSO ERM, and your governance structure.
Read More
A complete guide to CIS Controls Version 8 — the 18 controls, three implementation groups, how to conduct a CIS Controls assessment, and how to use CIS Benchmarks to harden your systems.
Read More
A complete guide to Secure SDLC — how to integrate security requirements, threat modelling, code review, SAST/DAST, and penetration testing into every phase of your development lifecycle to produce more secure software faster.
Read More
A deep dive into the OWASP API Security Top 10 2023 — what each API vulnerability is, how attackers exploit it, and how to build defences into your API design, development, and operations.
Read More
A complete guide to BSIMM (Building Security In Maturity Model) — how it works, the 121 activities across 12 practices, how a BSIMM assessment is conducted, and how to use BSIMM data to prioritise your software security programme.
Read More
A complete guide to UK GDPR — how it differs from EU GDPR, the role of the ICO, international transfer mechanisms post-Brexit, and what organisations processing UK personal data must do to stay compliant.
Read More
A complete guide to the SWIFT Customer Security Programme — mandatory controls, the CSCF framework, community standard controls, the annual attestation process, and how to achieve and maintain CSP compliance as a SWIFT correspondent.
Read More
A complete guide to ISO 22301, the international standard for business continuity management. Learn how to build a BCMS, conduct BIA, develop recovery plans, and achieve certification that satisfies regulators and enterprise buyers.
Read More
A comprehensive guide to PCI DSS v4.0 — the 12 requirements, SAQ types, QSA assessment process, network segmentation, the major changes from v3.2.1, and how to achieve and maintain compliance as a merchant or service provider.
Read More